I feel like maybe this should be a realm setting.
Let's say I am a user who lost my smart phone or my laptop. I think to
myself -- I should probably go and change my passwords, which I do,
expecting that I am now protected. But it is a false sense of security,
because the old sessions remain valid until they time out in one way or
another. If your users are consumers (which mine are) and not enterprise
users, it is a lot to have to educate each of them on the idea that in
addition to changing their password they have to go in to the account
management application and log out their sessions.
On Thu, Nov 6, 2014 at 3:34 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
IMO the current behaviour is the correct and I can't see any
reason to log
out a user after changing the password.
----- Original Message -----
> From: "Alarik Myrin" <alarik(a)zwift.com>
> To: keycloak-user(a)lists.jboss.org
> Sent: Wednesday, 5 November, 2014 9:25:01 PM
> Subject: [keycloak-user] Changing passwords and current sessions
> Should changing a password invalidate current sessions, or at least the
> refresh tokens? Or would a user have to change the password AND log out
> current sessions to invalidate the current sessions and refresh tokens?
> me it seems like the latter is the current behavior, I just wanted to
> sure that it is desirable.
> keycloak-user mailing list